Secrets, Security Insights and APIs!

by Alok Shukla on April 28, 2020

Secrets, Security Insights, and APIs!

ShiftLeft Inspect can now detect “hardcoded secrets” (across all languages), and provide “security insights” into your JavaScript code. ShiftLeft Inspect has also released a new version of API (v4) to support notions of scans, apps, and export security insights and detected secrets for individual apps.

Ability to detect hardcoded secrets

ShiftLeft Inspect can now perform detection of hardcoded secrets across all languages supported by ShiftLeft Inspect starting today. As part of the analysis

ShiftLeft can detect secrets in different categories such as URL, Infrastructure, API Keys, Username/Passwords, and PII data.
These results could be configured to appear obfuscated and can be filtered by specifying an appropriate entropy condition.

Best of all, the user does not have to provide any new options to invoke this analysis. Detected secrets will just be available out of the box as one more set of findings for any new analysis.

Security Insights

Security Insights are a collection of findings that indicate if a particular code snippet can lead to vulnerabilities today or in the future. These insights help a developer avoid such code issues at an early stage and can help prevent the onset of vulnerabilities.

Currently, this feature is only available for JavaScript language and will soon be extended to all other languages supported by ShiftLeft Inspect.

Sponsorships Available

API Version 4

This release also makes a substantial upgrade in APIs to access ShiftLeft Inspect analysis results. Now users can use APIs to

Check for results of individual scans
Iterate on individuals apps, individual scans per app to fetch the precise information he/she is looking for.
Fetch results of a new class of findings such as Secrets, Insights in addition to an existing class of findings as in vulnerabilities in any combination she/he desires.

Coming soon — a swagger compliant format of all of our APIs.

Prologue

All of the above features are now available to all ShiftLeft customers and are part of the current pipeline.

Click here for a free trial of ShiftLeft Inspect.

Secrets, Security Insights and APIs! was originally published in ShiftLeft Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.